February 2004 - openSUSE Security - openSUSE Mailing Lists

Re: Kernel k_deflt-2.4.21-144.i586.rpm initrd-Problem...
by Security 29 Feb '04

29 Feb '04

Ok, I downdated the system to the original Kernel to be found on cd. Then I tried to install the kernel downloaded at ftp://ftp.gwdg.de/pub/suse/i386/update/9.0/rpm/i586/k_deflt-2.4.21-192.i586.rpm But I still have the same problem. When I do mybox:~ # rpm -Uhv k_deflt-2.4.21-192.i586.rpm Preparing... ########################################### [100%] 1:k_deflt ########################################### [100%] Changing symlink /boot/vmlinuz from vmlinuz-2.4.21-99-default to vmlinuz-2.4.21-192-default Changing symlink /boot/initrd from initrd-2.4.21-99-default to initrd-2.4.21-192-default Root device: /dev/hda6 (mounted on / as ext2) No initrd required Using grub, re-install of bootloader not required. And no initrd is there in /boot. And another mkinitrd outputs Root device: /dev/hda6 (mounted on / as ext2) No initrd required I don't have another box which would need the default kernel so I can't figure out wether it's the default kernel package or my box. Does anybody have the the same problem? Could someone please help me? Thanx. Kind regards Marius Heidenstecker

3 3

RE: [suse-security] Freedom for everyone
by Rainer_Link＠trendmicro.de 29 Feb '04

29 Feb '04

>>> From: <draht(a)suse.de> >>> Request >>spam? spoofed mail? test? secret message? :) ><human-virus-scanner>That's Bagle.E</human-virus-scanner> Uhm, to be more precise: seems to be send from Bagle.E best regards, Rainer Link

1 0

RE: [suse-security] Freedom for everyone
by Rainer_Link＠trendmicro.de 29 Feb '04

29 Feb '04

-----Original Message----- From: Andreas Bittner [mailto:abittner@stud.fh-heilbronn.de] Sent: Sun 2/29/2004 7:47 PM To: suse-security(a)suse.com Cc: Subject: Re: [suse-security] Freedom for everyone >> From: <draht(a)suse.de> >> Request >spam? spoofed mail? test? secret message? :) <human-virus-scanner>That's Bagle.E</human-virus-scanner> best regards, Rainer Link

1 0

Freedom for everyone
by draht＠suse.de 29 Feb '04

29 Feb '04

Request

2 1

Is it possible to restrict a users access to only a few shell commands.
by Bo Jacobsen 29 Feb '04

29 Feb '04

I need to restrict specific users access to only a few shell commands. Some users maybe only need commands like ls, cat, ping, sudo and su, and I like to make sure that NO other commands are avaliable to them. Is this possible ?. I have thought about using chroot, but if the user uses su, he need to be able to have access to all the commands the new user has. Is there a super simple and maybe more secure shell then bash ?. ------------------------------------------------- Med venlig hilsen Bo Jacobsen SystemHouse Vesterbrogade 149, 1620 København V Tlf: 70 21 18 70 Fax: 33 25 05 71 e-mail: Bo(a)SystemHouse.dk

2 1

Re: [suse-security] Kernal patch
by John Andersen 28 Feb '04

28 Feb '04

On Saturday 28 February 2004 05:36, Keith Roberts wrote: > On Fri, 27 Feb 2004, John Andersen wrote: > > To: suse-security(a)suse.com > > From: John Andersen <jsa(a)pen.homeip.net> > > Subject: [suse-security] Kernal patch > > > > That patch was auto-applied by YOU on one of my production servers > > (a dual PII with a software raid on a dual IDE card and which boots from > > a SCSI drive (aic7xxx). > > > > It was NOT safe. It would NOT boot, it kept getting dma timeouts > > and lost interrupts on one of the ide drives (which were part of > > the raid 1 array, not the boot drive). > > I had terrible problems with Linux Software RAID1 using the > md kernel driver, under 8.1. > > I had 2 WD800JB drives as a RAID1 array on hdb & hdc. > > hda was another WD800JB with the SuSE 8.1 system on it. > > hdd was the CD-ROM drive. > > I used to get funny dma timeout messages in > /var/log/boot.msg. > > Seek error ... > > This only happened on the WD800JB connected to hdc. > > The other two WD drives did not get this. Sorry to hear about this Keith. In my case, my software raid 1 has been rock solid stable since SuSE 7.2, thru two upgrades. My only trick has been quality drives, and installing the system on other disks, just useing the raid for company business data. I've often contemplated going to one of those ide raid cards so that Linux sees it as a single device, but have held off because 1) I have the processing power to handle it as the CPU(s) are never busy, and 2) IINBDFI (if its not broke don't fix it), and 3) as my CUP power grows with new platforms the raid performance grows as well where-as the hardware raid remains at the speed it was born with. This same raid has been running for 4 years. But again, the topic of the thread was a bad kernel update not bad hardware. Moving back to the prior kernel has FIXED everything. -- _____________________________________ John Andersen

1 0

Re: [suse-security] Apache log "CONNECT a.b.c.d:25" "200" (fwd)
by Keith Roberts 28 Feb '04

28 Feb '04

> ok, I found this in my personal archive, > and the link is even still vaild: > > Bug #19113 > HTTP status 200 returned on HTTP CONNECT when mod_proxy not in use > http://bugs.php.net/bug.php?id=19113 > > > Lars Ellenberg Thankyou Lars for your help! I have looked at the bug report, and applied the following 'patch' to httpd.conf, after my DocRoot Directory container. This is followed by another Directory listing to deny access to the rest of my srv docs. I only want to allow access to the root directory, so others can get my site homepage by just entering the domain name of the machine. snip xxxxx <Directory "/"> DirectoryIndex karsites.hml Options None AllowOverride None Order Deny,Allow Allow from all </Directory> # remove the CONNECT bug # http://bugs.php.net/bug.php?id=19113 <Location /> <Limit CONNECT> Order deny,allow Deny from all </Limit> </Location> snip xxxxx # end of httpd.conf However, when I do karsites:/home/keith # telnet localhost 80 Trying ::1... telnet: connect to address ::1: Connection refused Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. CONNECT 127.0.0.1:80 HTTP/1.0 Without the fix to limit CONNECT, I get the raw source code from my DirectoryIndex page, karsites.hml With the patch applied to httpd.conf I get the following: HTTP/1.1 403 Forbidden Date: Sat, 28 Feb 2004 15:07:07 GMT Server: Apache/1.3.26 (Linux/SuSE) Connection: close Content-Type: text/html; charset=iso-8859-1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>403 Forbidden</TITLE> </HEAD><BODY> <H1>Forbidden</H1> You don't have permission to access / on this server.<P> <HR> <ADDRESS>Apache/1.3.26 Server at <A HREF="mailto:keith@my-server.co.uk">my-server.co.uk</A> Port 80</ADDRESS> </BODY></HTML> Connection closed by foreign host. karsites:/home/keith # Which is just the source code for the Apache generated error message. The access_log now records the correct details - 127.0.0.1 - - [28/Feb/2004:15:34:27 +0000] "CONNECT 127.0.0.1:80 HTTP/1.0" 403 311 NB is it possible for an attacker to ftp to my machine, and use the above technique to download the source code of my web applications? Kind Regards - Keith Roberts

1 0

Secure postfix against spammers
by Sneferu 28 Feb '04

28 Feb '04

Hi all, I have a suse I use as email server and I have noticed that it is used for sending spam. I am new to this so can you please point me to a tutorial/manual on how to secure it against this kind of problems? Thank you. --------------------------------------------------------------- Cauta-ti perechea pe http://dating.acasa.ro

4 3

Kernel k_deflt-2.4.21-144.i586.rpm initrd-Problem...
by Security 28 Feb '04

28 Feb '04

Hi list, I'm new to linux. And I have a problem concerning the Kernel Patch. I just updated 2 SUSE Linux 9.0 Pro boxes with YOU which worked fine. They needed the athlon-Kernel. Then I was about to update another box which needed the default kernel. The download and installation of the RPMs worked fine, too. When I rebooted GRUB was loaded and made the output that initrd wasn''t found and Error 15 occured. Linux was of course unable to boot. I tried to do the kernel update manually with rpm -Uhv k_deflt-2.4.21-144.i586.rpm and got the output: Root device: /dev/hda6 (mounted on / as ext2) No initrd required Using grub, re-install of bootloader not required. When I go into /boot there is an initrd-file which is marked red and links to a initrd-2.4.21-144-default which isn't found. When I try to mkinitrd I get the same output as above (no initrd required). Could somebody help me please? I hope this is posted right here in the security issues... Thanx-a-lot Marius

1 0

Kernal patch
by John Andersen 28 Feb '04

28 Feb '04

On or about Wed 18 Feb 2004 23:18:41 Thomas Biege <thomas(a)suse.de> announced here (on this list) that there was a kernal patch available and this patch specifically mentioned this source for SuSE 8.1 > ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_psmp-2.4.21-189.i586… That patch was auto-applied by YOU on one of my production servers (a dual PII with a software raid on a dual IDE card and which boots from a SCSI drive (aic7xxx). At the time I reported that the patch idendified itself as for an athlon, and I wondered if it was safe to boot that machine with this kernel 189. Yesterday, I got around to finding out. It was NOT safe. It would NOT boot, it kept getting dma timeouts and lost interrupts on one of the ide drives (which were part of the raid 1 array, not the boot drive). I also discovered that booting with the DVD from the boxed set offers no way automated to downgrade the kernel. I was able to boot in rescue mode, mount the /root drive (scsi) and copy the rpms for the older kernel to that drive. Then by physically removing all other drives/controllers except the scsi root drive, I was able to get it to boot and manually install the older kernal rpms for 2.4.19-4GB-SMP. (After pounding on grub for each boot to tell him which drives things were located upon, and manually rebuilding /boot, and a great deal of other hacking). This took the better part of a whole day but I lost no data in the end. Needless to say I'm in no hurry to upgrade to 189 again. There was no hardware error, the 189 kernel simply did not work with this combination, or it was indeed an athlon kernal as it reported itself to be. Would an athlon kernel even boot on a dual Pii machine? Someone reported here that the "athlon thingie" was fixed in the 8.1 smp kernels a day or two later. Was that "thingie" merly cosmetic as was aledged? Are thare other problems with this 189 kernel for 8.1 that have come to light since the announcement? -- _____________________________________ John Andersen

1 0